I have found that the release notes of Sequoia actually state that any app group format should work, when the app is distributed through the app store or includes it in the provisioning profile (highlights by me):
Specifically, the app must use FileManager to get the app group container path and meet one of the following requirements: the app is deployed through Mac App Store; the app group identifier is prefixed with the app’s Team ID; or the app group identifier is authorised by a provisioning profile embedded within the app.
Also, I have discovered in the release notes of macOS 15.1 beta 4 sate that it fixes the following issue:
Fixed: Users might be incorrectly prompted when an app that is distributed through TestFlight attempts to access an application group container. (131606564) (FB14288230)
I understand, that the security alert should actually not be shown and is currently only shown for XCode and TestFlight builds. I can verify, that no such alert is shown when I run the App Store version of my app. I haven't tested the new 15.1 beta yet, however.
So this might actually not be a big issue after all. 😮💨